U.S. Sanctions Iran-Linked Hackers Behind Critical Infrastructure Breaches

The feed reports a broad set of significant cybersecurity developments, including active exploitation of critical Oracle WebLogic/HTTP Server and GitLab vulnerabilities, severe Keycloak account takeover and miniOrange SAML authentication bypass flaws, AI-agent and notebook command-execution risks, phishing-as-a-service campaigns targeting Microsoft 365, malicious npm packages, malware delivery via fake CAPTCHA pages and gaming sites, RAT and backdoor campaigns, and attacks against critical infrastructure and web servers. Multiple items involve unauthenticated remote compromise, account or data